[pull] main from breadboard-ai:main

.agent/rules/breadboard.md

@@ -0,0 +1,79 @@
+---
+trigger: always_on
+---
+
+## Build system
+
+This is a monorepo that uses wireit as a build system. This means that the
+commands in `package.json` files are typically wireit commands that invoke the
+full build system to first ensure that all dependencies are satisfied. For
+example:
+
+- `npm run build` or `npm run build:tsc` builds all monorepo dependencies and
+  then runs tsc to compile the target.
+- `npm run test` first invokes build (or `build:tsc`) for all dependencies, then
+  runs testing.
+
+## Packages
+
+These are some significant packages:
+
+- `packages/types` -- contains only type definitons. This is package is designed
+  to allow defining types that are used across the package to avoid circular
+  references. Any time you need to add a cross-package type, add it here.
+
+- `packages/utils` -- contains commonly used functions and classes. If you're
+  looking to implement a helper function, first look in `packages/utils` to see
+  if it might be already present there.
+
+- `packages/breadboard`, `packages/runtime`, `packages/data`, `packages/loader`
+  -- contain the core runtime engine for the project and all the data
+  transformation/processing code.
+
+- `packages/visual-editor` -- contains the majority of the frontend code for the project.
+
+- `unified-server` -- contains the nodejs server, the backend of the project.
+
+## Signals
+
+The repo is using `signal-polyfil` and `signal-utils` as its signal infrastructure.
+
+## Coding Conventions
+
+### Exports
+
+Use ES Module syntax for imports/exports.
+
+Define exports explicitly at the top of the file, right below the imports.
+
+```ts
+import { foo } from "./foo";
+// ... more imports
+
+export { bar, baz };
+
+function bar() {
+  // function impl.
+}
+
+function baz() {
+  // function impl.
+}
+
+// not exported
+function quz() {
+  // function impl.
+}
+```
+
+## Tests
+
+To write tests, use node's built-in test framework. Use the `npm run test` command within the package to run tests.
+
+Name tests as `[name of tested file].test.ts` and place it into
+`packages/[package name]/tests/` directory. All packages are configured to pick
+up that file with `npm run test`.
+
+If you're writing a test in `packages/visual-editor/tests` and the code-to-be-tested
+contains signals, use the `packages/visual-editor/tests/signal-watcher.ts` helper
+for easy reactivity testing.

.eslintrc.json

@@ -1,4 +1,5 @@
 {
+  "root": true,
   "env": {
     "browser": true,
     "es2021": true
@@ -21,6 +22,9 @@
     "@typescript-eslint/no-unused-vars": [
       "warn",
       { "argsIgnorePattern": "_.*" }
-    ]
+    ],
+    "@typescript-eslint/no-unused-expressions": "warn",
+    "@typescript-eslint/no-require-imports": "warn",
+    "@typescript-eslint/no-unsafe-function-type": "warn"
   }
 }

.github/dependabot.yml

@@ -1,41 +1,44 @@
+# References:
+#
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+#
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates#setting-up-a-cooldown-period-for-dependency-updates
+
 version: 2
 updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
-    reviewers:
-      - dglazkov
-      - aomarks
+    open-pull-requests-limit: 10
+    # Use a cooldown to wait for updates to become stable before applying them.
+    # This helps to mitigate npm attacks, because the more time has elapsed
+    # since an attack was published, the more likely it has been discovered and
+    # removed. Major and minor updates are also further slowed to reduce churn
+    # and review time.
+    #
+    # Note that known security updates always bypass this cooldown.
+    cooldown:
+      default-days: 7
+      semver-patch-days: 7
+      semver-minor-days: 14
+      semver-major-days: 21
+    groups:
+      # Minor and patch changes should in theory never be breaking, so let's
+      # consolidate them into a single PR so that they can be merged together.
+      minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+        exclude-patterns:
+          # TypeScript doesn't follow semver, because it regularly publishes
+          # breaking changes (e.g. stricter type-checking) as minor updates.
+          - typescript
 
   - package-ecosystem: "github-actions"
     directory: ".github/workflows"
     schedule:
       interval: "daily"
-    reviewers:
-      - dglazkov
-      - aomarks
-
-  - package-ecosystem: "pip"
-    directory: "packages/breadboard-python/breadboard_python"
-    schedule:
-      interval: "daily"
-    reviewers:
-      - dglazkov
-      - aomarks
-
-  - package-ecosystem: "pip"
-    directory: "packages/breadboard-python/breadboard_colab"
-    schedule:
-      interval: "daily"
-    reviewers:
-      - dglazkov
-      - aomarks
-
-  - package-ecosystem: "devcontainers"
-    directory: ".devcontainer"
-    schedule:
-      interval: "daily"
-    reviewers:
-      - dglazkov
-      - aomarks
+    cooldown:
+      default-days: 7